2 Unix SMB/CIFS implementation.
4 manipulate nbt name structures
6 Copyright (C) Andrew Tridgell 2005
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 see rfc1002 for the detailed format of compressed names
27 #include "librpc/gen_ndr/ndr_nbt.h"
28 #include "librpc/gen_ndr/ndr_misc.h"
29 #include "system/locale.h"
30 #include "lib/util/util_net.h"
32 /* don't allow an unlimited number of name components */
33 #define MAX_COMPONENTS 10
38 _PUBLIC_
void ndr_print_nbt_string(struct ndr_print
*ndr
, const char *name
, const char *s
)
40 ndr_print_string(ndr
, name
, s
);
44 pull one component of a nbt_string
46 static enum ndr_err_code
ndr_pull_component(struct ndr_pull
*ndr
,
52 unsigned int loops
= 0;
54 if (*offset
>= ndr
->data_size
) {
55 return ndr_pull_error(ndr
, NDR_ERR_STRING
,
56 "BAD NBT NAME component");
58 len
= ndr
->data
[*offset
];
61 *max_offset
= MAX(*max_offset
, *offset
);
63 return NDR_ERR_SUCCESS
;
65 if ((len
& 0xC0) == 0xC0) {
66 /* its a label pointer */
67 if (1 + *offset
>= ndr
->data_size
) {
68 return ndr_pull_error(ndr
, NDR_ERR_STRING
,
69 "BAD NBT NAME component");
71 *max_offset
= MAX(*max_offset
, *offset
+ 2);
72 *offset
= ((len
&0x3F)<<8) | ndr
->data
[1 + *offset
];
73 *max_offset
= MAX(*max_offset
, *offset
);
77 if ((len
& 0xC0) != 0) {
78 /* its a reserved length field */
79 return ndr_pull_error(ndr
, NDR_ERR_STRING
,
80 "BAD NBT NAME component");
82 if (*offset
+ len
+ 2 > ndr
->data_size
) {
83 return ndr_pull_error(ndr
, NDR_ERR_STRING
,
84 "BAD NBT NAME component");
86 *component
= (uint8_t*)talloc_strndup(ndr
, (const char *)&ndr
->data
[1 + *offset
], len
);
87 NDR_ERR_HAVE_NO_MEMORY(*component
);
89 *max_offset
= MAX(*max_offset
, *offset
);
90 return NDR_ERR_SUCCESS
;
93 /* too many pointers */
94 return ndr_pull_error(ndr
, NDR_ERR_STRING
, "BAD NBT NAME component");
98 pull a nbt_string from the wire
100 _PUBLIC_
enum ndr_err_code
ndr_pull_nbt_string(struct ndr_pull
*ndr
, int ndr_flags
, const char **s
)
102 uint32_t offset
= ndr
->offset
;
103 uint32_t max_offset
= offset
;
104 unsigned num_components
;
107 if (!(ndr_flags
& NDR_SCALARS
)) {
108 return NDR_ERR_SUCCESS
;
113 /* break up name into a list of components */
114 for (num_components
=0;num_components
<MAX_COMPONENTS
;num_components
++) {
115 uint8_t *component
= NULL
;
116 NDR_CHECK(ndr_pull_component(ndr
, &component
, &offset
, &max_offset
));
117 if (component
== NULL
) break;
119 name
= talloc_asprintf_append_buffer(name
, ".%s", component
);
120 NDR_ERR_HAVE_NO_MEMORY(name
);
122 name
= (char *)component
;
125 if (num_components
== MAX_COMPONENTS
) {
126 return ndr_pull_error(ndr
, NDR_ERR_STRING
,
127 "BAD NBT NAME too many components");
129 if (num_components
== 0) {
130 name
= talloc_strdup(ndr
, "");
131 NDR_ERR_HAVE_NO_MEMORY(name
);
135 ndr
->offset
= max_offset
;
137 return NDR_ERR_SUCCESS
;
141 push a nbt string to the wire
143 _PUBLIC_
enum ndr_err_code
ndr_push_nbt_string(struct ndr_push
*ndr
, int ndr_flags
, const char *s
)
145 if (!(ndr_flags
& NDR_SCALARS
)) {
146 return NDR_ERR_SUCCESS
;
150 enum ndr_err_code ndr_err
;
155 /* see if we have pushed the remaing string allready,
156 * if so we use a label pointer to this string
158 ndr_err
= ndr_token_retrieve_cmp_fn(&ndr
->nbt_string_list
, s
, &offset
, (comparison_fn_t
)strcmp
, false);
159 if (NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
162 if (offset
> 0x3FFF) {
163 return ndr_push_error(ndr
, NDR_ERR_STRING
,
164 "offset for nbt string label pointer %u[%08X] > 0x00003FFF",
168 b
[0] = 0xC0 | (offset
>>8);
169 b
[1] = (offset
& 0xFF);
171 return ndr_push_bytes(ndr
, b
, 2);
174 complen
= strcspn(s
, ".");
176 /* we need to make sure the length fits into 6 bytes */
177 if (complen
> 0x3F) {
178 return ndr_push_error(ndr
, NDR_ERR_STRING
,
179 "component length %u[%08X] > 0x0000003F",
180 (unsigned)complen
, (unsigned)complen
);
183 compname
= talloc_asprintf(ndr
, "%c%*.*s",
184 (unsigned char)complen
,
185 (unsigned char)complen
,
186 (unsigned char)complen
, s
);
187 NDR_ERR_HAVE_NO_MEMORY(compname
);
189 /* remember the current componemt + the rest of the string
190 * so it can be reused later
192 NDR_CHECK(ndr_token_store(ndr
, &ndr
->nbt_string_list
, s
, ndr
->offset
));
194 /* push just this component into the blob */
195 NDR_CHECK(ndr_push_bytes(ndr
, (const uint8_t *)compname
, complen
+1));
196 talloc_free(compname
);
202 /* if we reach the end of the string and have pushed the last component
203 * without using a label pointer, we need to terminate the string
205 return ndr_push_bytes(ndr
, (const uint8_t *)"", 1);
210 decompress a 'compressed' name component
212 static bool decompress_name(char *name
, enum nbt_name_type
*type
)
215 for (i
=0;name
[2*i
];i
++) {
216 uint8_t c1
= name
[2*i
];
217 uint8_t c2
= name
[1+(2*i
)];
218 if (c1
< 'A' || c1
> 'P' ||
219 c2
< 'A' || c2
> 'P') {
222 name
[i
] = ((c1
-'A')<<4) | (c2
-'A');
226 *type
= (enum nbt_name_type
)(name
[15]);
230 *type
= NBT_NAME_CLIENT
;
233 /* trim trailing spaces */
234 for (;i
>0 && name
[i
-1]==' ';i
--) {
243 compress a name component
245 static uint8_t *compress_name(TALLOC_CTX
*mem_ctx
,
246 const uint8_t *name
, enum nbt_name_type type
)
252 if (strlen((const char *)name
) > 15) {
256 cname
= talloc_array(mem_ctx
, uint8_t, 33);
257 if (cname
== NULL
) return NULL
;
259 for (i
=0;name
[i
];i
++) {
260 cname
[2*i
] = 'A' + (name
[i
]>>4);
261 cname
[1+2*i
] = 'A' + (name
[i
]&0xF);
263 if (strcmp((const char *)name
, "*") == 0) {
269 cname
[2*i
] = 'A' + (pad_char
>>4);
270 cname
[1+2*i
] = 'A' + (pad_char
&0xF);
274 cname
[2*i
] = 'A' + (pad_char
>>4);
275 cname
[1+2*i
] = 'A' + (pad_char
&0xF);
283 pull a nbt name from the wire
285 _PUBLIC_
enum ndr_err_code
ndr_pull_nbt_name(struct ndr_pull
*ndr
, int ndr_flags
, struct nbt_name
*r
)
292 if (!(ndr_flags
& NDR_SCALARS
)) {
293 return NDR_ERR_SUCCESS
;
296 NDR_CHECK(ndr_pull_nbt_string(ndr
, ndr_flags
, &s
));
298 scope
= (uint8_t *)strchr(s
, '.');
301 r
->scope
= talloc_strdup(ndr
->current_mem_ctx
, (const char *)&scope
[1]);
302 NDR_ERR_HAVE_NO_MEMORY(r
->scope
);
307 cname
= discard_const_p(char, s
);
309 /* the first component is limited to 16 bytes in the DOS charset,
310 which is 32 in the 'compressed' form */
311 if (strlen(cname
) > 32) {
312 return ndr_pull_error(ndr
, NDR_ERR_STRING
,
313 "NBT NAME cname > 32");
316 /* decompress the first component */
317 ok
= decompress_name(cname
, &r
->type
);
319 return ndr_pull_error(ndr
, NDR_ERR_STRING
,
320 "NBT NAME failed to decompress");
323 r
->name
= talloc_strdup(ndr
->current_mem_ctx
, cname
);
324 NDR_ERR_HAVE_NO_MEMORY(r
->name
);
328 return NDR_ERR_SUCCESS
;
332 push a nbt name to the wire
334 _PUBLIC_
enum ndr_err_code
ndr_push_nbt_name(struct ndr_push
*ndr
, int ndr_flags
, const struct nbt_name
*r
)
336 uint8_t *cname
, *fullname
;
337 enum ndr_err_code ndr_err
;
339 if (!(ndr_flags
& NDR_SCALARS
)) {
340 return NDR_ERR_SUCCESS
;
343 if (strlen(r
->name
) > 15) {
344 return ndr_push_error(ndr
, NDR_ERR_STRING
,
345 "nbt_name longer as 15 chars: %s",
349 cname
= compress_name(ndr
, (const uint8_t *)r
->name
, r
->type
);
350 NDR_ERR_HAVE_NO_MEMORY(cname
);
353 fullname
= (uint8_t *)talloc_asprintf(ndr
, "%s.%s", cname
, r
->scope
);
354 NDR_ERR_HAVE_NO_MEMORY(fullname
);
360 ndr_err
= ndr_push_nbt_string(ndr
, ndr_flags
, (const char *)fullname
);
367 copy a nbt name structure
369 _PUBLIC_ NTSTATUS
nbt_name_dup(TALLOC_CTX
*mem_ctx
, struct nbt_name
*name
, struct nbt_name
*newname
)
372 newname
->name
= talloc_strdup(mem_ctx
, newname
->name
);
373 NT_STATUS_HAVE_NO_MEMORY(newname
->name
);
374 newname
->scope
= talloc_strdup(mem_ctx
, newname
->scope
);
376 NT_STATUS_HAVE_NO_MEMORY(newname
->scope
);
382 push a nbt name into a blob
384 _PUBLIC_ NTSTATUS
nbt_name_to_blob(TALLOC_CTX
*mem_ctx
, DATA_BLOB
*blob
, struct nbt_name
*name
)
386 enum ndr_err_code ndr_err
;
388 ndr_err
= ndr_push_struct_blob(blob
, mem_ctx
, name
, (ndr_push_flags_fn_t
)ndr_push_nbt_name
);
389 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
390 return ndr_map_error2ntstatus(ndr_err
);
397 pull a nbt name from a blob
399 _PUBLIC_ NTSTATUS
nbt_name_from_blob(TALLOC_CTX
*mem_ctx
, const DATA_BLOB
*blob
, struct nbt_name
*name
)
401 enum ndr_err_code ndr_err
;
403 ndr_err
= ndr_pull_struct_blob(blob
, mem_ctx
, name
,
404 (ndr_pull_flags_fn_t
)ndr_pull_nbt_name
);
405 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
406 return ndr_map_error2ntstatus(ndr_err
);
414 choose a name to use when calling a server in a NBT session request.
415 we use heuristics to see if the name we have been given is a IP
416 address, or a too-long name. If it is then use *SMBSERVER, or a
419 _PUBLIC_
void nbt_choose_called_name(TALLOC_CTX
*mem_ctx
,
420 struct nbt_name
*n
, const char *name
, int type
)
425 if ((name
== NULL
) || is_ipaddress(name
)) {
426 n
->name
= "*SMBSERVER";
429 if (strlen(name
) > 15) {
430 const char *p
= strchr(name
, '.');
433 n
->name
= "*SMBSERVER";
436 s
= talloc_strndup(mem_ctx
, name
, PTR_DIFF(p
, name
));
437 n
->name
= talloc_strdup_upper(mem_ctx
, s
);
441 n
->name
= talloc_strdup_upper(mem_ctx
, name
);
446 escape a string into a form containing only a small set of characters,
447 the rest is hex encoded. This is similar to URL encoding
449 static const char *nbt_hex_encode(TALLOC_CTX
*mem_ctx
, const char *s
)
453 const char *valid_chars
= "_-.$@ ";
454 #define NBT_CHAR_ALLOW(c) (isalnum((unsigned char)c) || strchr(valid_chars, c))
456 for (len
=i
=0;s
[i
];i
++,len
++) {
457 if (!NBT_CHAR_ALLOW(s
[i
])) {
462 ret
= talloc_array(mem_ctx
, char, len
+1);
463 if (ret
== NULL
) return NULL
;
465 for (len
=i
=0;s
[i
];i
++) {
466 if (NBT_CHAR_ALLOW(s
[i
])) {
469 snprintf(&ret
[len
], 4, "%%%02x", (unsigned char)s
[i
]);
480 form a string for a NBT name
482 _PUBLIC_
char *nbt_name_string(TALLOC_CTX
*mem_ctx
, const struct nbt_name
*name
)
484 TALLOC_CTX
*tmp_ctx
= talloc_new(mem_ctx
);
487 ret
= talloc_asprintf(mem_ctx
, "%s<%02x>-%s",
488 nbt_hex_encode(tmp_ctx
, name
->name
),
490 nbt_hex_encode(tmp_ctx
, name
->scope
));
492 ret
= talloc_asprintf(mem_ctx
, "%s<%02x>",
493 nbt_hex_encode(tmp_ctx
, name
->name
),
496 talloc_free(tmp_ctx
);
501 pull a nbt name, WINS Replication uses another on wire format for nbt name
503 _PUBLIC_
enum ndr_err_code
ndr_pull_wrepl_nbt_name(struct ndr_pull
*ndr
, int ndr_flags
, const struct nbt_name
**_r
)
507 uint32_t namebuf_len
;
509 if (!(ndr_flags
& NDR_SCALARS
)) {
510 return NDR_ERR_SUCCESS
;
513 NDR_CHECK(ndr_pull_align(ndr
, 4));
514 NDR_CHECK(ndr_pull_uint32(ndr
, NDR_SCALARS
, &namebuf_len
));
515 if (namebuf_len
< 1 || namebuf_len
> 255) {
516 return ndr_pull_error(ndr
, NDR_ERR_ALLOC
, "value out of range");
518 NDR_PULL_ALLOC_N(ndr
, namebuf
, namebuf_len
);
519 NDR_CHECK(ndr_pull_array_uint8(ndr
, NDR_SCALARS
, namebuf
, namebuf_len
));
521 if ((namebuf_len
% 4) == 0) {
523 * [MS-WINSRA] — v20091104 was wrong
524 * regarding section "2.2.10.1 Name Record"
526 * If the name buffer is already 4 byte aligned
527 * Windows (at least 2003 SP1 and 2008) add 4 extra
528 * bytes. This can happen when the name has a scope.
531 NDR_CHECK(ndr_pull_uint32(ndr
, NDR_SCALARS
, &pad
));
534 NDR_PULL_ALLOC(ndr
, r
);
536 /* oh wow, what a nasty bug in windows ... */
537 if (namebuf
[0] == 0x1b && namebuf_len
>= 16) {
538 namebuf
[0] = namebuf
[15];
542 if (namebuf_len
< 17) {
545 r
->name
= talloc_strndup(r
, (char *)namebuf
, namebuf_len
);
546 if (!r
->name
) return ndr_pull_error(ndr
, NDR_ERR_ALLOC
, "out of memory");
550 talloc_free(namebuf
);
552 return NDR_ERR_SUCCESS
;
555 r
->type
= namebuf
[15];
558 trim_string((char *)namebuf
, NULL
, " ");
559 r
->name
= talloc_strdup(r
, (char *)namebuf
);
560 if (!r
->name
) return ndr_pull_error(ndr
, NDR_ERR_ALLOC
, "out of memory");
562 if (namebuf_len
> 17) {
563 r
->scope
= talloc_strndup(r
, (char *)(namebuf
+16), namebuf_len
-17);
564 if (!r
->scope
) return ndr_pull_error(ndr
, NDR_ERR_ALLOC
, "out of memory");
569 talloc_free(namebuf
);
571 return NDR_ERR_SUCCESS
;
575 push a nbt name, WINS Replication uses another on wire format for nbt name
577 _PUBLIC_
enum ndr_err_code
ndr_push_wrepl_nbt_name(struct ndr_push
*ndr
, int ndr_flags
, const struct nbt_name
*r
)
580 uint32_t namebuf_len
;
582 uint32_t scope_len
= 0;
585 return ndr_push_error(ndr
, NDR_ERR_INVALID_POINTER
,
586 "wrepl_nbt_name NULL pointer");
589 if (!(ndr_flags
& NDR_SCALARS
)) {
590 return NDR_ERR_SUCCESS
;
593 _name_len
= strlen(r
->name
);
594 if (_name_len
> 15) {
595 return ndr_push_error(ndr
, NDR_ERR_STRING
,
596 "wrepl_nbt_name longer as 15 chars: %s",
601 scope_len
= strlen(r
->scope
);
603 if (scope_len
> 238) {
604 return ndr_push_error(ndr
, NDR_ERR_STRING
,
605 "wrepl_nbt_name scope longer as 238 chars: %s",
609 namebuf
= (uint8_t *)talloc_asprintf(ndr
, "%-15s%c%s",
611 (r
->scope
?r
->scope
:""));
612 if (!namebuf
) return ndr_push_error(ndr
, NDR_ERR_ALLOC
, "out of memory");
614 namebuf_len
= strlen((char *)namebuf
) + 1;
617 * we need to set the type here, and use a place-holder in the talloc_asprintf()
618 * as the type can be 0x00, and then the namebuf_len = strlen(namebuf); would give wrong results
620 namebuf
[15] = r
->type
;
622 /* oh wow, what a nasty bug in windows ... */
623 if (r
->type
== 0x1b) {
624 namebuf
[15] = namebuf
[0];
628 NDR_CHECK(ndr_push_align(ndr
, 4));
629 NDR_CHECK(ndr_push_uint32(ndr
, NDR_SCALARS
, namebuf_len
));
630 NDR_CHECK(ndr_push_array_uint8(ndr
, NDR_SCALARS
, namebuf
, namebuf_len
));
632 if ((namebuf_len
% 4) == 0) {
634 * [MS-WINSRA] — v20091104 was wrong
635 * regarding section "2.2.10.1 Name Record"
637 * If the name buffer is already 4 byte aligned
638 * Windows (at least 2003 SP1 and 2008) add 4 extra
639 * bytes. This can happen when the name has a scope.
641 NDR_CHECK(ndr_push_zero(ndr
, 4));
644 talloc_free(namebuf
);
645 return NDR_ERR_SUCCESS
;
648 _PUBLIC_
void ndr_print_wrepl_nbt_name(struct ndr_print
*ndr
, const char *name
, const struct nbt_name
*r
)
650 char *s
= nbt_name_string(ndr
, r
);
651 ndr_print_string(ndr
, name
, s
);
655 _PUBLIC_
enum ndr_err_code
ndr_push_nbt_res_rec(struct ndr_push
*ndr
, int ndr_flags
, const struct nbt_res_rec
*r
)
658 uint32_t _flags_save_STRUCT
= ndr
->flags
;
659 ndr_set_flags(&ndr
->flags
, LIBNDR_PRINT_ARRAY_HEX
);
660 if (ndr_flags
& NDR_SCALARS
) {
661 NDR_CHECK(ndr_push_align(ndr
, 4));
662 NDR_CHECK(ndr_push_nbt_name(ndr
, NDR_SCALARS
, &r
->name
));
663 NDR_CHECK(ndr_push_nbt_qtype(ndr
, NDR_SCALARS
, r
->rr_type
));
664 NDR_CHECK(ndr_push_nbt_qclass(ndr
, NDR_SCALARS
, r
->rr_class
));
665 NDR_CHECK(ndr_push_uint32(ndr
, NDR_SCALARS
, r
->ttl
));
666 NDR_CHECK(ndr_push_set_switch_value(ndr
, &r
->rdata
, ((((r
->rr_type
) == NBT_QTYPE_NETBIOS
) && ((r
->rdata
).data
.length
== 2))?0:r
->rr_type
)));
667 NDR_CHECK(ndr_push_nbt_rdata(ndr
, NDR_SCALARS
, &r
->rdata
));
669 if (ndr_flags
& NDR_BUFFERS
) {
671 ndr
->flags
= _flags_save_STRUCT
;
673 return NDR_ERR_SUCCESS
;